The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries (tfsec and checkov) to perform security scans on local directories. It uses the node:child_process spawn and spawnSync APIs with argument arrays, which is a secure practice that prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing the necessary security tools from official and well-known sources such as the Homebrew package manager, the Python Package Index (PyPI), and the official GitHub repository for Aqua Security.
[SAFE]: The implementation follows standard patterns for CLI wrappers. It detects the appropriate tool based on file presence (e.g., main.tf), invokes the tool with JSON output flags, and transforms the resulting data into a structured report for the user.
[SAFE]: No network operations or data exfiltration attempts were identified in the source code. The skill's operation is restricted to the local file system path provided by the user.

iac-scanner